Exploit for CVE-2026-5432

--- 7. CVE-2026-5432 – GraphQL Batching Alias Confusion SQL...

dbeaver v26.1.4

DBeaver Free multi-platform database tool for developers, SQL programmers, database administrators and analysts. Has a lot of features including schema editor, SQL editor, data editor, AI integration, ER diagrams, data export/import/migration, SQL execution plans, database administration tools,...

PT-2026-67111

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-52521

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature...

PT-2026-67437

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten leadin query parameter, which is concatenated without parameterized binding directly...

PT-2026-67113

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks...

CVE-2026-41453: Improper Neutralization of Special Elements used in an SQL Command

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rottenleadin query parameter, which is concatenated without parameterized binding directly...

CVE-2026-69086: Improper Limitation of a Pathname to a Restricted Directory

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish...

ROS-20260803-73-0002

The vulnerability of the RedisBloom data structure module of the Redis database management system is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

perl-DBI security update

1.643-26.3 - Fix CVE-2026-14380: unsafe string eval in DBI::Profile - Resolves: RHEL-211146 1.643-26.2 - Fix CVE-2026-14739: set a hard limit of 99999 on '?' placeholders - Resolves: RHEL-193293...

perl-DBI security update

1.643-9.3 - Fix unsafe string eval in DBI::Profile CVE-2026-14380 - Resolves: RHEL-211149 1.643-9.2 - Set a hard limit of 99999 on '?' placeholders CVE-2026-14739 - Resolves: RHEL-193306...

ALSA-2026:49514 Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: DBI: Arbitrary cod...

ALSA-2026:49612 Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: DBI: Arbitrary cod...

AlmaLinux 10 : perl-DBI (ALSA-2026:49514)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:49514 advisory. DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute CVE-2026-14380 DBI: DBI: Heap overflow when preparsing SQL statements with...

RHEL 10 : perl-DBI (RHSA-2026:49514)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49514 advisory. DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions...

RHEL 9 : perl-DBI (RHSA-2026:49612)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49612 advisory. DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions,...

PT-2026-67406

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description The '/api/search/searchEmbedBlock' endpoint passes a client-supplied SQL statement directly to the main read-write siyuan.db handle without restrictions on single statements, read-only access, or...

Oracle Linux 9 : perl-DBI (ELSA-2026-49612)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-49612 advisory. - Fix unsafe string eval in DBI::Profile CVE-2026-14380 - Set a hard limit of 99999 on '?' placeholders CVE-2026-14739 Tenable has extracted the...

Important: perl-DBI security update

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: DBI: DBI: Arbitrary cod...

PostgreSQL Empty Password

Tests common PostgreSQL usernames for trust or empty-password login via psycopg2. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL trust / empty-password access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...